CVE-2026-111702 sugarforever CVE debrief

Who should care

Defenders responsible for ChatOllama deployments, especially those using versions up to commit 96c3ce5, should assess exposure and verify the effectiveness of current access controls and monitoring. This includes developers, security teams, and IT professionals managing ChatOllama instances.

Why it matters

CVE-2026-111702 is a high-severity IDOR vulnerability in ChatOllama that allows remote attackers to access private knowledge bases. Defenders should verify exposure, assess access controls, and prioritize remediation due to the potential for unauthorized access to sensitive information.

• Remote attackers can access private knowledge bases without authentication.
• Enumeration of knowledge base IDs is possible, allowing for potential reconnaissance.
• Access to metadata and document content of other users' knowledge bases is possible.
• Verification of access controls and monitoring effectiveness is necessary.

Technical summary

The ChatOllama application through commit 96c3ce5 contains an insecure direct object reference (IDOR) vulnerability. This vulnerability allows remote attackers to access other users' private knowledge bases by supplying sequential IDs. The vulnerability can be exploited through GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat, allowing attackers to read metadata and retrieved document content.

Defensive priority

Defenders should prioritize verifying exposure of ChatOllama deployments, especially those using versions up to commit 96c3ce5, and assess the effectiveness of current access controls and monitoring.

Recommended defensive actions

• Verify ChatOllama deployments for exposure, especially those using versions up to commit 96c3ce5.
• Assess the effectiveness of current access controls and monitoring for ChatOllama knowledge bases.
• Consider upgrading to a version beyond commit 96c3ce5 if available.
• Monitor for unusual activity or enumeration attempts on knowledge base IDs.
• Perform a thorough review of ChatOllama knowledge base access controls to prevent unauthorized access.
• Implement additional monitoring to detect potential exploitation attempts.
• Conduct a security audit to identify and address any other potential vulnerabilities.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence through commit 96c3ce5 and the potential for remote attackers to access private knowledge bases. However, specific details on affected versions beyond this commit and the exact scope of exploitation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.